This policy describes how OmniStrat AI ("we," "us," "OmniStrat") handles personal information when you use OmniStrat Foundry, the Terminal, Agora, or the marketing site at omnistrat.ai. We have written it the way we would want one written for us: plain language, no dark patterns, clearly enumerated.

1. What we collect

Account data

• Email and name when you create a Passport.
• Password hash using PBKDF2-SHA256 at 600,000 iterations (OWASP 2023+ guidance). We never store your password in clear text and cannot recover it.
• Account metadata: creation date, last sign-in, sign-in IP, subscription tier, entitlements.

Product use

• Foundry: API request counts, provider used, model used, token counts, cost in USD. Every call is cryptographically signed and hash-chained into an append-only audit record. Prompt and response bodies are not retained beyond ephemeral audit-trail purposes (see Section 3).
• Terminal: the orders you place route directly to your broker. We do not see, store, or have ability to see your broker credentials. Order history shown in the Terminal is fetched live from your broker on each session; every order is signed to an immutable archive for compliance.
• Agora: Passport identity, cohort membership, attestations you sign, Match Certificates you produce. Attestation payloads and public keys are retained; private keys never leave your device.

Site analytics

• Cloudflare Web Analytics, privacy-preserving, no cookies, no fingerprinting. Aggregated page views and country only.
• Standard request logs at our edge (IP, user agent, path) retained for security and abuse detection for 30 days.

2. What we never do

• We do not sell your data. Not to anyone, not under any circumstance.
• We do not run ad networks, embed ad pixels, or share data with advertisers.
• We do not read your AI prompts or completions outside the cases described in Section 3.
• We do not require third-party trackers to use the site. The only third-party requests served from our pages are Google Fonts (CSS only, no cookies) and Cloudflare Web Analytics.

3. How we use what we collect

• To provide the service. Authentication, billing, request routing, save state, cohort matchmaking.
• To enforce safety. The Router uses provider-side moderation on outbound content and may temporarily quarantine prompts that trip safety classifiers. Quarantined content is retained for 7 days for appeal, then deleted.
• To audit security incidents. Our append-only audit chain records security-relevant events (auth, billing, admin actions). Retained for 90 days unless required longer by law or active investigation.
• To bill you. Stripe processes payments. Stripe receives the data needed to bill (email, payment method, amount). They do not receive your prompts or save data.

4. Encryption at rest

Personal identifiers (email, phone, address) are encrypted with AES-GCM-256 in an envelope pattern with HKDF subkey separation by purpose, and a HMAC-SHA256 blind index for lookups. The encryption keys are held outside the database. An operator-level database breach does not yield plaintext PII. Sensitive product-specific data uses purpose-scoped keys so a Foundry-side incident cannot expose Terminal or Agora state.

5. Data residency

Our default deployment runs on Cloudflare's global edge with origin Postgres in US-East. Workers Durable Objects, KV, R2, and Vectorize indexes are co-located with the request when possible. For Enterprise customers, we deploy a single-tenant stack in the region you choose (EU, US, APAC, or sovereign).

6. Your rights

Regardless of where you live, you have the right to:

• Access a copy of your data. Email privacy@omnistrat.ai.
• Correct inaccurate information.
• Delete your account. Call POST /api/gdpr/delete-me with your Passport bearer token and the header x-confirm-delete: <your user_id>, or email privacy@omnistrat.ai and we will action it for you. Deletion propagates within 30 days to backups. Records that form part of a hash-chained audit trail cannot be individually erased without destroying the chain's integrity for every other party to it; those are retained under the schedule below and severed from your identity instead.
• Export your data in machine-readable form. Call GET /api/gdpr/export-me with your Passport bearer token; the response is JSON. Terminal trade history is separately exportable as CSV or JSON from GET /api/terminal/export. If you would rather we send it to you, email privacy@omnistrat.ai.
• Object to any processing not strictly necessary to deliver the service.

If you are in the EU/UK, GDPR/UK-GDPR applies. If you are in California, CCPA/CPRA applies. If you are anywhere else and have a request, we will honor it on the same timeline regardless.

7. Cookies

Foundry, Terminal, and Agora authenticate with the OmniStrat Passport JWT in localStorage rather than cookies, so requests sent to api.omnistrat.ai from the marketing site do not carry session cookies. No analytics cookies. No marketing cookies. No third-party cookies of any kind.

8. Children

OmniStrat AI is not for users under 13. We do not knowingly collect data from children under 13. If you believe a child has created an account, email privacy@omnistrat.ai and we will delete it.

9. Changes to this policy

If we materially change how we handle your data we will email account holders before the change takes effect and post the new policy with a new "Last updated" date. Non-material changes (typos, clarifications) may be made without notice.

10. Contact

Privacy questions, deletion requests, and DSAR submissions go to privacy@omnistrat.ai. Security disclosures go to security@omnistrat.ai. General contact at hello@omnistrat.ai.